Personal access tokens

Overview

Personal access tokens let trusted automation you control — scripts, internal tools, CI jobs — act on your behalf in Tendersight without opening a browser. Each token has a name, selected permissions, and a secret shown exactly once at creation.

Tokens authenticate you as a user, not a team. Which team's data an integration touches depends on how the tool is written and which team context it uses when calling APIs.

Tip: Before creating a token:

Name it after the integration (Nightly export, ERP sync) — not test
Grant minimum permissions required for the job
Store the secret in a password manager or secrets vault immediately
Plan rotation when staff leave or credentials leak

Important: You cannot view the secret again after closing the creation dialog. If lost, delete the old token and create a new one.

Caution: Never commit tokens to source control, paste them in chat, or embed them in client-side web pages.

How tokens relate to connected services

Mechanism	Purpose	Typical user
Personal access tokens	Your scripts call Tendersight APIs as you	Developers, power users
Connected services	Team-level integrations (WooCommerce, GoMag, etc.)	Administrators under Team → Integrations

Tokens are for automation you build. Connected services are product-managed integrations with OAuth or team credentials.

How to open

Path	Steps
Account menu	Avatar or name → Personal access tokens (label may appear as API tokens on some accounts)

You must be signed in. The page title is Personal access tokens.

Page layout

Two main areas when tokens exist:

Area	Contents
Create token form	Name, permission checkboxes, Create button
Manage personal access tokens	List of existing tokens with actions

If no tokens exist yet, only the create form is prominent.

Create a token

Step by step

Open Personal access tokens from the account menu.
Enter a name you will recognise later (e.g. Staging inventory sync).
Under Permissions, enable only what the integration needs. Permissions appear as a checkbox grid when your account has definable scopes.
Click Create.
A dialog shows the new secret with a warning: "Please copy your new token. For your security, it won't be shown again."
Copy the secret into your password manager or deployment secrets store.
Close the dialog.

Configure your integration with the secret before closing — retrieval is impossible afterward.

Permission selection guide

Principle	Practice
Least privilege	Start with read-only scopes if available
One integration per token	Revoke individually when decommissioning
Document mapping	Keep an internal list: token name → system → permissions

Exact permission labels depend on your account configuration. If unsure, create a narrow token and expand only after testing.

Manage existing tokens

The Manage personal access tokens section lists each token:

Column / action	Description
Name	Label you chose at creation
Last used	Shown when the system has usage data
Permissions	Summary of enabled scopes
Edit permissions	Opens checkboxes → Save or Cancel
Delete	Removes token after confirmation

Edit permissions

Click Edit permissions on a token row.
Adjust checkboxes.
Click Save.

Existing integrations keep using the same secret; only allowed actions change.

Delete a token

Click Delete.
Confirm: Are you sure you would like to delete this token?

Any integration still using that secret fails until you issue a new token and update configuration.

Security practices

Practice	Why
One token per integration	Isolate blast radius on revoke
Minimum permissions	Limits damage if leaked
Rotate after staff changes	Former employees may have copied secrets
Rotate after suspected leak	Assume compromise until replaced
Server-side only	Never expose tokens in browser JavaScript
Audit last used	Remove idle tokens

Team and data context

Question	Answer
Which team does a token use?	Depends on API calls — many endpoints require team scope in the request or active team context
Can teammates use my token?	They should not — tokens are personal credentials
Does deleting my account revoke tokens?	Yes — account deletion removes associated tokens
Same as login password?	No — separate credential with scoped permissions

For team-wide product integrations, prefer Connected services under Team → Integrations.

Lifecycle diagram

Edge cases

Scenario	Behaviour
Menu item missing	Feature disabled for account — contact administrator
Integration suddenly 403	Token deleted, permissions narrowed, or account disabled
Duplicate token names	Allowed — distinguish by creation date and permissions
Edit while job running	In-flight requests may succeed or fail based on new scopes

Troubleshooting

Symptom	Likely cause	Action
Integration stopped working	Token deleted or rotated	Create new token; update config
Access denied / 403	Missing permission on token	Edit permissions or create broader token (last resort)
Cannot find menu item	Feature disabled	Contact administrator
Secret lost after create	By design	Delete token; create new one
Works locally, fails in CI	Wrong secret env var	Verify vault injection; no trailing spaces

FAQ

Can I see my token secret again?

No. Copy at creation or rotate with a new token.

Should I use one token for everything?

No. Use one token per integration for clean revocation.

Do tokens expire automatically?

Not by default in typical setups — delete unused tokens manually. Organisation policy may differ.

Are tokens the same as OAuth for WooCommerce?

No. WooCommerce and similar use Connected services at team level.

What happens if I delete my account?

Personal access tokens for that account stop working.

Can I limit a token to one team?

Use team-scoped API calls and permissions your administrator enables — design integrations to pass the correct team context.

Profile settings
Connected services
Team settings
Billing